[Bug]: Cursor Auto Intelligence echoes [Tool Result] as assistant chat after native tool calls #2317

Client or integration

Codex App

Area

Provider adapter

Summary

After a successful Codex tool call on cursor/auto-intelligence, the next assistant turn can paste the OpenCodex Cursor adapter's history envelope as chat instead of using the structured tool result.

Observed assistant text:

[Tool Result]
[tool_result]
call_id: call-...
name: exec
is_error: false
output:
<script output>

The expected next turn is ordinary assistant text or another structured tool call. The envelope above is not a Codex-native transcript format; it is the Cursor adapter's rootPromptMessagesJson serialization.

This is not covered by a live tracker:

• [Bug] Cursor adapter injects hide-from-user policy and fake user-turn tool-result replay; downstream agents treat it as prompt injection #1992 / fix(cursor): stop hide-from-user policy and user-role tool-result replay (#1992) #1997 moved tool-result root replay from role: user to role: assistant so Cursor would not wrap it as <user_query>. That closed the injection report, but native Auto now few-shot-mimics the assistant-role marker as chat.
• The existing [Tool Call] leak guard already documents this few-shot failure mode. There is no matching guard for [Tool Result] on native resume models.
• [Bug]: Cursor client-tool continuation can return tool-call-like assistant text to Pi #2305 is a cousin (Cursor returning tool-call-like assistant text to Pi) with a different transcript shape and is currently needs-info.

Reproduction

1. Run OpenCodex 2.26.0 (or current dev) on loopback and route Codex App through the Cursor adapter.
2. Select cursor/auto-intelligence.
3. Ask for a host-side shell/process inspection that produces a real exec / exec_command tool result (for example leftover vitest trees plus a few local apps).
4. After the tool result returns, observe the next assistant message.

The assistant can reprint the adapter envelope instead of summarizing or continuing:

[Tool Result]
[tool_result]
call_id: call-921fbd01-5289-4b95-a401-ab380c66b270-0
name: exec
is_error: false
output:
Script completed
...

Code path: src/adapters/cursor/protobuf-request.ts rootPromptMessages() serializes prior toolResult messages as assistant-role text with [Tool Result]\n[tool_result]\ncall_id: .... cursor/auto-intelligence is a native resume model (auto-* → wire default), so turns[] already carries the paired MCP result. The extra assistant-role root blob is what Auto copies into chat.

Version

@bitkyc08/opencodex 2.26.0 locally; the same root-replay path is still on current dev (ffa6d46d7).

Operating system

macOS 26.6 (arm64)

Provider and model

cursor / auto-intelligence (Codex selector cursor/auto-intelligence, adapter cursor, native resume / resumeAction)

Logs or error output

[Tool Result]
[tool_result]
call_id: call-921fbd01-5289-4b95-a401-ab380c66b270-0
name: exec
is_error: false
output:
Script completed
Wall time 0.5 seconds
Output:
TARGET_APPS
  496 Agent Cat ...
VITEST_TREES
35535 1 314384 node .../vitest.mjs --run ...

OpenCodex request history for the same route records successful Cursor-adapter turns (provider: cursor, model: auto-intelligence, HTTP 200). The failure is the model-visible prompt shape, not the upstream HTTP boundary.

Redacted configuration

{
  "route": "cursor/auto-intelligence",
  "adapter": "cursor",
  "admissionKind": "loopback",
  "inboundProtocol": "responses",
  "nativeLocalExec": "off (default)"
}

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.